How to Protect Against Phishing in Crypto
Crypto phishing uses fake websites, messages or support accounts to trick you into revealing your recovery phrase or login details, or into signing a malicious wallet request. Verifying addresses and signatures is the core defense.
On this page 7
Crypto phishing is fraud that uses a fake website, message, app or support account to trick you into handing over your recovery phrase or exchange login, or into signing a malicious request with your wallet. The key difference from classic phishing is that attackers don’t even need your password: a single bad signature can be enough to move the tokens out of your wallet.
Because blockchain transactions can’t be reversed, prevention is the only reliable protection. Below are the most common attack types, the warning signs to watch for and what to do in the first hours if something goes wrong.
Common types of crypto phishing
Fake websites and search ads
Scammers build pixel-perfect copies of popular wallets, exchanges and DeFi apps and push them to the top of search results with paid ads. The domain differs by a single letter, a different extension or look-alike characters. The fake site then asks you to “validate” or “sync” your wallet by entering your recovery phrase, or gets you to approve a malicious signature.
Fake support and pressure tactics
Ask a question in a Telegram, Discord or X community and a “support agent” may slide into your DMs. Real support teams don’t message you first. These messages usually come with urgency (“your account will be closed in 24 hours”) and a link or form. Fake “suspicious login” emails and texts serve the same purpose.
Malicious signature requests (wallet drainers)
You can lose funds without ever sharing your recovery phrase. Fake sites running off-the-shelf “drainer” kits ask you to sign something that looks harmless after you connect your wallet. In reality it may be:
- An unlimited token approval: gives a contract the right to spend your tokens. Token allowances stay active until you revoke them.
- An NFT collection approval (setApprovalForAll): lets an address move every NFT you hold in that collection.
- A permit signature: a free, off-chain “message” signature that doesn’t look like a transaction but still grants spending rights. Because there’s no gas fee, people assume it’s harmless.
Fake airdrops and rewards
An unfamiliar token or NFT appears in your wallet with a note telling you to visit a site to claim your reward. When you hit “claim,” what you’re actually signing is a permission request, not a reward. The safest approach is to ignore assets you didn’t ask for.
Address poisoning
An attacker sends you worthless or zero-value transfers from an address whose start and end match one you use often, hoping you’ll copy it from your history next time. Clipboard-hijacking malware that swaps copied addresses has a similar effect.
SIM swapping
An attacker can trick your mobile carrier into moving your phone number to their SIM card, then use SMS codes to break into exchange accounts protected by text-message two-factor authentication. An authenticator app such as Google Authenticator or a hardware security key is much safer.
How to spot crypto phishing
- You’re asked for your recovery phrase, private key or password.
- The message pushes urgency, threats or a can’t-miss opportunity.
- The domain differs from the official one by a letter, a hyphen or an extension.
- A simple action triggers an “approve,” “setApprovalForAll” or “permit” request.
- An unsolicited token, NFT or “reward” points you to a website.
- “Support” contacts you first in a private message.
Everyday habits that keep you safe
- Bookmark the exchanges, wallets and DeFi sites you use instead of reaching them through search results.
- Keep your long-term savings in a different wallet from the one you connect to apps, and only hold what you need for the task in the latter.
- Before every signature, read the transaction type, contract address, token and amount on your wallet screen. If you don’t understand it, don’t sign it.
- Use a hardware wallet for larger amounts and verify recipient addresses on the device screen.
- Take addresses from the recipient’s verified screen or your saved address book, not your transaction history.
- Every few months, review your token approvals and revoke the ones you no longer need.
How to protect your exchange account from phishing
Exchange accounts are frequent phishing targets too. Many exchanges offer settings that blunt the risk:
- Anti-phishing code: a personal code that appears in genuine emails from the exchange. An email without it is fake.
- Withdrawal address whitelist: restricts withdrawals to addresses you’ve approved in advance, so even a hijacked account is hard to drain to an attacker’s address.
- App-based two-factor authentication: use an authenticator app or security key instead of SMS.
- A dedicated email address: use a strongly protected email for your exchange account that you don’t share on social media.
What to do if you connected to a suspicious site
Connecting alone, which simply shows the site your wallet address, doesn’t let anyone spend your funds. The risk depends on whether you signed a transaction or message afterwards. Disconnecting the site in your wallet is a good first step, but it doesn’t cancel permissions you’ve already granted.
- Check your wallet history and a block explorer for any approvals or unexpected transfers.
- If you granted an approval, revoke it right away with a trusted allowance management tool.
- If you think you signed an off-chain permit, move the affected tokens to another address immediately.
What to do if you shared your recovery phrase
Revoking approvals won’t help here: the attacker effectively owns the wallet. Create a brand-new wallet with a new seed phrase on a secure device and move everything to it, starting with the most valuable and quickest-to-move assets. Speed matters, because the attacker may be racing you.
Afterwards, stop using the old wallet and document what happened: transaction IDs, the fake site’s address and screenshots of messages. That record helps when contacting exchanges and, if needed, the authorities. “Recovery services” that reach out promising to get your money back are usually a second scam.